C-GCP-IAM-BACKDOORPersistence

GCP Service Account Backdoor Key

Generate a long-lived JSON key for a low-noise SA whose only role is impersonating an admin — stealth re-entry.

§ Where this technique fits

C-GCP-IAM-BACKDOOR is catalogued under the Persistence tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

§ Dossiers chaining this technique

GCP service account impersonation chain → project owner
Compromised low-priv SA has iam.serviceAccounts.getAccessToken on an intermediate SA; hop through 2-3 impersonations until you reach a project Owner.
step 6 / 6

§ Where this technique fits

§ Dossiers chaining this technique

GCP service account impersonation chain → project owner